Skills/Glama/hoistline

hoistline@r1

VERIFIED· install only

Publisher claims: "Exposes a single authenticated MCP endpoint that federates to agents running on your own machines, letting you delegate coding jobs to be worked in fresh git worktrees and pushed to a branch, or proxy the stdio MCP servers installed there as tools. Agents dial out through a Cloudflare Tunnel and enforce your local policy, so no inbound ports are opened." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher ajthom90 · publishing for 8 daysInstalls 0Last detonated 3d ago
$npx skills add hoistline
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GITHUB_CLIENT_SECRETConfiguration, not credentials: CONSENT_PATH, DATABASE_PATH, GIT_NO_REPLACE_OBJECTS, GIT_TERMINAL_PROMPT, GITHUB_CLIENT_ID, HOISTLINE_AGENT_HOME, HOISTLINE_ALLOWED_USERS, HOISTLINE_VERSION, LOGIN_CALLBACK_PATH, MAX_TRACKED_PATHS
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
use of the skill by an agent

Connect it with a scoped credential, under the guard. It asks for GITHUB_CLIENT_SECRET and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is hoistline@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Destructive file system command detectedDockerfile:8 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedDockerfile:25 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandDockerfile:29 · File permission modification command — agent changes file ownership/permissions&& chown 10001:10001 /data \Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandDockerfile:30 · File permission modification command — agent changes file ownership/permissions&& chmod 700 /dataFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/smoke-docker.sh:29 · Process kill command — agent can terminate processesif [ -n "$AGENT_PID" ]; then kill "$AGENT_PID" 2>/dev/null || true; wait "$AGENT_PID" 2>/dev/null || true; fiFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/smoke-docker.sh:52 · File permission modification command — agent changes file ownership/permissionschmod 0777 "$TMP/data"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathsdocker-compose.yml:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Hoistline hub. Copy .env.example to .env, fill it in, then: docker compose up -dFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandpackages/hub/src/store.ts:128 · File permission modification command — agent changes file ownership/permissions* a filesystem that refuses chmod (some network mounts) keeps whatever the umask gave.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandpackages/agent/src/runners/run.ts:154 · Process kill command — agent can terminate processes// Its own process group on POSIX, so a kill reaches everything the runner started (unless it left the group).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandpackages/agent/package.json:19 · File permission modification command — agent changes file ownership/permissions"build": "tsc -p tsconfig.json && chmod 755 dist/bin.js"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionpackages/agent/src/proxy.ts:574 · File type combined with upload action — agent may exfiltrate local data filesif (stderrLines === MAX_STDERR_LINES) this.log(`server ${escapeForTerminal(state.name)}: further stderr output not shown`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathsdocker-compose.yml:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# TUNNEL_TOKEN: ${TUNNEL_TOKEN:?set TUNNEL_TOKEN in .env}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionpackages/hub/src/store.ts:542 · File type combined with upload action — agent may exfiltrate local data filesconst row = this.db.prepare("SELECT status, output, output_truncated FROM jobs WHERE id = ?").get(jobId) asFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandpackages/agent/src/git.ts:238 · Process kill command — agent can terminate processes// Detached on POSIX makes git a process-group leader, so a timeout can kill its helpers too.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Fake instruction boundary tagdocs/runners.md:328 · Fake instruction boundary tag · informational: not an instruction file**Grok.** `grok --single <prompt>` (`-p`) runs one turn headless and exits. `grok --help` and `grok help` documentFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionpackages/agent/src/job-output.ts:160 · File type combined with upload action — agent may exfiltrate local data files* Opens `<dir>/<jobId>.log` for a job's full output: a new file (never an existing one or a symlink), mode 0600, inFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathsdocker-compose.yml:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesPUBLIC_URL: ${PUBLIC_URL:?set PUBLIC_URL in .env}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionpackages/hub/src/tools/proxy.ts:372 · File type combined with upload action — agent may exfiltrate local data filesif (this.pendingLists.delete(callId)) this.log(`direct mode: machine ${machineId} did not send its tool list`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandpackages/agent/src/children.ts:5 · Process kill command — agent can terminate processes* Ctrl-C) can kill them all at once. Process-wide: the agent runs one executor.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Rule modification attemptdocs/runners.md:331 · Rule modification attempt — overwriting existing instructions · informational: not an instruction file`wrapPromptForArgv` (`prompt_too_large: ... for grok` above 120 KiB). This is the allowed exception to rule 3:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commanddocker-compose.yml:20 · File permission modification command — agent changes file ownership/permissions# uid 10001 and private to it: chown 10001:10001 and chmod 700.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Fake instruction boundary tagdocs/runners.md:39 · Fake instruction boundary tag · informational: not an instruction file(Grok): the prompt is then exactly one argv element of the form `--flag=<prompt>`, never two elements. ClapFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Fake instruction boundary tagdocs/runners.md:330 · Fake instruction boundary tag · informational: not an instruction fileMuse), so the wrapped prompt is passed as the single argv element `--single=<prompt>`, built withFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagedeploy/truenas/README.md:64 · Authorization escalation language · informational: not an instruction file- The YAML holds your secrets in the app's configuration. Anyone with admin access to TrueNAS can read them.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionpackages/agent/src/proxy.ts:580 · File type combined with upload action — agent may exfiltrate local data filesthis.log(`direct mode: server ${escapeForTerminal(state.name)}: skipped output that is not JSON-RPC`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Fake instruction boundary tagdocs/runners.md:255 · Fake instruction boundary tag · informational: not an instruction file…approve [-m <model>] --single=<preamble + prompt>` | one argv element `--single=<prompt>` (help documents no stdin form) | `-m <model>` | | build-test | Task 8 | `sh` (…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈33 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.